One distinguished advantage of ContraNet is its robustness to adaptive attacks. First, the generative model itself is more robust than discriminative model under adversarial attack [1]}. Also, the target classifier and our detection mechanism have separate gradient propagation paths. The only connection between them is the predicted label produced by a non-differentiable argmax operation. Therefore, the attacker cannot implement an end-to-end gradient-based adaptive attack. Moreover, similar to the SAEC technique used in the LP-defense layer, ContraNet is also an attack-agnostic plug-and-play defense solution that requires the training dataset only. In Table REF , we show the number of parameters and the number of GFLOPS of ContraNet for CIFA10 dataset. As can be observed, the size and inference cost of ContraNet is moderate, considering the fact that classifiers used in safety-critical applications are usually quite large to achieve extremely high accuracy.
